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ABSTRACT 

The National Aeronautics and Space Administration (NASA) is conducting 
research in digital fly-by-wire (DFBW) flight control for aircraft. The 
primary impetus for this work has come from the projected flight control 
system requirements for advanced military and commercial aircraft, partic- 
ularly in the area of active controls. Such systems must have extremely 
high levels of reliability and computational capacity. 

From 1972 to 1980. the NASA Dryden Flight Research Center (DFRC) con- 
ducted flight tests of a DFBW control system in an F-8C aircraft. 

A triplex digital fly-bv-wire flight control system was developed and 
then installed in the aircraft to provide fail-operative, full authority 
control. Hardware and software redundancy management techniques were 
designed to detect and identify failures in the system. Control functions 
typical of those projected for future actively controlled vehicles were 
implemented . 
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NASA F-8 DIGITAL FLY-BY-WIRE PROGRAM 


NASA has been conducting research in aircraft digital fly-by-wire 
control at the Dryden, Langley. Ames. Lewis, and Johnson centers. The 
primary objective of this work is the development of highly reliable flight 
control systems that permit the implementation of active control functions, 
which contribute to energy efficiency and high maneuverability. A major 
flight experiment at the Dryden Flight Research Center involves the use of a 
Navy F-8C testbed aircraft that was modified to incorporate full authority 
digital fly-by-wire controls. The vehicle has a triplex fail-operational 
digital flv-by-wire primary flight control system and an analog emergency 
backup control system. 
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F-8/DFBW LIGHTNING SUSCEPTIBILITY TESTS 


To learn more about possible lightning effects on digital fly-bv-wire 
systems, a series of NASA-sponsored research programs were conducted by 
Lightning Technologies Inc. and the Air Force Flight Dynamics Laboratory at 
Wright Patterson, using the F-8/DFBW aircraft. This research led to develop- 
ment of a nondestructive method, now known as the lightning transient 
analysis (LTA) test, for determining the level of lightning-induced voltages 
in aircraft electrical circuits. These test results were widely distributed 
in industry and prompted positive efforts to design lightning protection 
into other aircraft being designed with fly-by-wire control systems, 
including the USAF/General Dynamics F-16. the USN/McDonnell Douglas F-18 
and the NASA space shuttle. 







F-8/DFBW FLIGHT CONTROL SYSTEM MAJOR COMPONENTS 


The heart of the F-8/DFBW flight control system is the triplex computer 
and interface unit assembly mounted on a removable pallet for easy access. 

A digital mode and gain panel located in the cockpit provides the pilot with 
system status information. Similar data are provided for the redundant 
actuators on a servo status panel. Analog backup electronics are located in 
the aircraft fuselage section as are the redundant rate gyro and acceler- 
ometer sensors. Each aircraft control surface is operated through a redun- 
dant servoactuator assembly that is commanded via the digital computers. 
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F-8/DFBW HANDLING QUALITIES SUMMARY 


Handling qualities ratings by pilots for all control modes, based on 
the Cooper-Harper rating scale, have been satisfactory and above for all 
augmented modes and borderline for direct modes with no augmented feedback 
narameters . Ratings did not tend to vary for instrument flight, mild manue- 
vering and landing approach tasks. 
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PREFLIGHT TEST PROGRAM EXPERIENCE 


All test flights are preceded by preflight tests comprised of hangar 
tests to verify system gains and scale factors, and automated flight-line 
tests that take approximately 5 minutes. The flight software program is 
generally loaded into the redundant computers during the hangar test, but 
can also be loaded during flight-line operations. Automated flight-line 
tests generally require pilot participation for switch operations and control 
inputs. No significant problems have been experienced with the integrity of 
the preflight procedures. 
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GROUND AND FLIGHT QUALIFICATION TESTS 


The iron bird facility was used to a much greater extent than the 
actual aircraft for ground and flight qualification testing. The actual 
aircraft was used primarily to validate results established using the iron 
bird, except for ground resonance and structural coupling testing which 
required the presence of valid vehicle structural modes. The importance of 
an iron bird facility as a cost effective means of accomplishing these types 
of tests cannot be over emphasized. 
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INDUCED- CURRENT MEASURED DURING E-8/DFBW LIGHTNING TRANSIENT ANALYSIS TESTS 


A wide range of lightning test conditions were applied to the F-8./DFBW 
aircraft, reaching potentials of up to 50.000 volts and simulated lightning 
currents of up to 8.000 amps. One of the more significant findings of this 
first series is that at the instant test voltage is applied to the aircraft, 
traveling wave currents are established that "ring" back and forth along 
the aircraft at the speed of light, much as mechanical vibrations are set up 
in an airplane when it encounters a gust of wind. These currents precede 
the flow of return stroke current and are considerably higher than it in 
frequency. The magnetic fields produced by these high frequency currents 
thus induce higher voltages in internal electrical circuits. 
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REMOTELY AUGMENTED VEHICLE TEST FACILITY 


The F-8/DFBW aircraft can also be operated in a unique control law 
evaluation mode. By selecting special on-board software, the pilot can 
bypass the on-board flight computer, and have his normal control commands 
transmitted via downlink to a special receiving antenna. The commands are 
then processed in special control law algorithms programmed on a ground-based 
computer, and computed surface commands are uplinked to the aircraft. The 
pilot, in effect, flies the aircraft through the ground-based control laws. 
This approach greatly simplifies the level of verification required to man 
rate research control laws for flight test purposes and becomes a very low 
cost means of flight testing advanced control law algorithms. 
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IRON BIRD TEST FACILITY 


An iron bird test facility was used in carrying out the many tests to 
support software and hardware verification. The facility consisted of an 
actual F-8 aircraft and all associated electric, electronic and hydraulic 
systems. A complete set of DFBW electronics and actuators were installed in 
the iron bird which was coupled to a six-degree-of-freedom closed-loop 
simulation of the F-8 dynamics. In addition to supporting ground verifica- 
tion and validation tests, the iron bird was also used for pilot training, 
pilot-in-the-loop failure mode, effects testing, and EMI testing. 
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F-8 DIGITAL FLY-BY-WIRE SYSTEM DESCRIPTION 


The overall mechanization of the F-8 DFBW control system is shown in 
this figure. A triplex digital computer set containing control law and 
system redundancy management software communicates with a specially designed 
interface unit (IFU). The IFU processes input data, which consist of pilot 
commands and aircraft sensor signals, and output data, which consist of 
surface commands, cockpit displays, and telemetry data. Surface commands 
are routed through a switching mechanism to the servodrive electronics and 
then to the force-summed secondary actuators, which are installed in series 
with the existing F-8C power actuators. There are five actuator sets: one 
for each aileron and horizontal stabilizer surface and one for the rudder. 

The triplex analog computer bypass system provides the pilot with an 
emergency unaugmented command path to the control surfaces in the event of a 
total primary digital system failure. This path was provided primarily to 
protect against a common-mode software failure in the infant stages of 
flight test. The switching mechanism allows either the primary system or 
the bypass system to drive the secondary actuators based on pilot selection 
or automatically, according to fault status. 

Electrical power is provided to three independent flight control buses 
by an engine-driven dc generator. Each bus is protected by a 40-ampere-hour 
battery, which would allow approximately 90 minutes of operation in the 
event of a loss of generator power. Secondary actuator hydraulic power is 
provided by the aircraft's three hydraulic systems, each of which supplies 
one of the triple chambers of each actuator. 
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IN-FLIGHT SYSTEM PERFORMANCE SUMMARY 


Over 80 research missions have been flown with the F8/DFBW system. All 
take-offs and landings have been accomplished with the primary digital 
system. No automatic reversion to the analog bypass system has ever been 
required. Four computer hard failures have occurred on separate flights 
resulting in loss of one of the three digital channels. In each case, the 
aircraft was operated on the remaining two channels. All failure detection, 
identification and recovery operations have been according to design. 

Although software errors have been discovered after initiation of the 
flight test program, no software errors have resulted in terminating a 
flight or aborting a mission, although this could have been the case had the 
right sequence of events occurred. 

Several control law refinements were required to improve overall flying 
qualities, especially about the roll axis. Roll control was initially 
extremely sensitive about neutral stick positions for precision control 
tasks such as formation flying. 

Very few cases of sensor failures have been noted, either hard or tran- 
sient fails. 

All failures that have occurred have been detected and properly 
resolved. 


• ALL TAKE-OFFS AND LANDINGS MADE WITH PRIMARY 
DIGITAL FLY-BY-WIRE SYSTEM 

• NO AUTOMATIC REVERSION TO ANALOG BY PASS 
SYSTEM HAS OCCURRED 

• FOUR IN-FLIGHT COMPUTER FAILURES 

• ONE TRANSIENT FAILURE IN-FLiGHT RESETTABLE 

• NO FLIGHT ABORTS DUE TO SOFTWARE FAULTS 

• SEVERAL CONTROL LAW REFINEMENTS NECESSARY 

• SOME SOFTWARE ERRORS DISCOVERED DURING 
FLIGHT TEST PROGRAM 

• VERY FEW SENSOR NUISANCE FAULTS 

• NO EXCEPTIONS TO FAIL-OP OR FAIL-SAFE DESIGN 
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CONTRACTOR AND UNIVERSITY STUDIES/ GRANTS 


In addition, a large number of supporting studies have been conducted 
by universities and contractors in support of various advanced concepts 
addressed by the F-8/DFBW program. 


ADVANCED CONTROL LAW CONCEPTS MIT 

RENSSELAER INSTITUTE (RPI) 
COLLEGE UNIVERSITY OF N.Y. 
(C.U.N.Y.) 

WILLIAM AND MARY 
VIRGINIA POLYTECHNIC 
*CSDL 

‘HONEYWELL 


• PHASE II CONCEPTUAL DESIGN HONEYWELL 

• FAULT-TOLERANT COMPUTER DESIGN ULTRASYSTEMS 

• DIGITAL FLIGHT CONTROL ACTUATION ROCKWELL 

• DFBW CERTIFICATION REQUIREMENTS CSDL 


‘CONCEPTS FLIGHT TESTED 


79 



CONTRACTOR SUPPORT 


Over 11 seperate contractors have been involved directly in support of 
the F-8/DFBW program. This broad scope of involvement has contributed 
greatly to the program's transfer of digital fly-by-wire technology to 
industry in a timely manner. 


CHARLES STARK DRAPER LAB SOFTWARE AND 

INTERFACE HARDWARE 

DELCO INTERFACE HARDWARE 

IBM COMPUTER HARDWARE 

RAYTHEON COMPUTER HARDWARE 

SPERRY FLIGHT SYSTEMS ANALOG BYPASS SYSTEM 

HYDRAULICS RESEARCH & MANUFACTURING . . . ACTUATORS 

LING, TEMCO, VOUGHT AIRCRAFT INTERFACE 

BOEING SNEAK CIRCUIT ANALYSIS 

G.E LIGHTNING TESTS 


LIGHTNING TECHNOLOGIES, INC LIGHTNING TESTS 

AIR FORCE FLIGHT DYNAMICS LAB LIGHTNING TESTS 
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JOINT NASA CENTER RESPONSIBILITIES FOR PHASE II PROGRAM 


Overall program management responsibility for the F-8/DFBW program, 
including flight qualification and flight testing, rests at Dryden Flight 
Research Center. Advanced control law and system architectural concepts 
developed at Langley Research Center have been an integral part of the 
F-8/DFBW program. Considerable support of the space shuttle control system 
development has taken place through joint efforts with the Johnson Space 
Center. A joint NASA/FAA workshop on digital flight controls, sponsored by 
the Ames Research Center, was also supported by the program in 1979. 


DRYDEN FLIGHT RESEARCH CENTER 

• PROGRAM MANAGEMENT 

• SYSTEM SPECIFICATION AND PROCUREMENT 

• OVERALL SYSTEMS INTEGRATION 

• SOFTWARE VERIFICATION 

• FLIGHT QUALIFICATION 

• FLIGHT TESTS 

LANGLEY RESEARCH CENTER 

• ADVANCED CONTROL LAW DEVELOPMENT 

• PHASE II CONCEPTUAL STUDY 

• DIGITAL ACTUATOR DEVELOPMENT STUDY 

JOHNSON SPACE CENTER 

• SPECIFY SHUTTLE SUPPORT TASKS 

• SUPPORT SHUTTLE SOFTWARE FLIGHT TEST 

AMES RESEARCH CENTER 

• JOINT NASA/FAA WORKSHOP 
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F-8/DFBW CONTROL LAWS 


Several advanced control law algorithms were developed and implemented 
in the F-8/DFBW system. The primary objective was to address the type of 
algorithms that might be applicable to future systems employing active 
control concepts. The goal was to tax the system as heavily as possible in 
order to identify limitations encountered in a realistic implementation of 
advanced control techniques. 


ACTIVE CONTROL LAWS 


INVESTIGATE PERFORMANCE AND INTEGRATION OF PROJECTED ACTIVE 
CONTROL FUNCTIONS 

• COMMAND AUGUMENTATION SYSTEM 

• BOUNDRY CONTROLLER ^LIMITER) 

• AUTOPILOT FUNCTIONS 

• RIDE SMOOTHING SYSTEM/MANEUVER FLAPS 

• LOW SAMPLE RATE EXPERIMENT 

ADAPTIVE CONTROL LAWS 

USE MODERN IDENTIFICATION THEORY TO ESTIMATE AIRCRAFT 
PARAMETERS FOR ADOPTIVE GAIN SCHEDULING 

• MAXIMUM LIKELIHOOD ESTIMATION 

• ESTIMATE DYNAMIC PRESSURE, a 

• IDENTIFICATION ALGORITHM ON GROUND COMPUTER 
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SOFTWARE ANOMALY EXPERIENCE 


Almost one year of verification testing was required before the system 
reached a level of maturity satisfactory for first flight. 1750 hours of 
system operating time were required during this period. Of significance is 
that even after extensive software verification testing, software anomalies 
occurred after the system was flight qualified, pointing to the fact that it 
is impossible to tell whether or not all latent software bugs have been 
identified and corrected. 


ACCUMULATIVE 

SOFTWARE 

ANOMALIES 



4000 


3000 

TOTAL SYSTEM 
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SUMMARY OF DIGITAL SUBSYSTEM GROUND TEST EXPERIENCE 


The amount of ground and verification testing required to bring the 
F-8/DFBW to a level of maturity was largely underestimated. Many problems 
requiring software changes and resultant verification were identified. The 
greatest number of changes occurred after initial integration of all subsys- 
tems. Many interrelating effects not identifiable in the early design phase 
were manifested, resulting in degraded operation. 

Sufficient automated testing techniques were also lacking, especially 
those required to monitor and interrogate simultaneously operating redundant 
digital computers. 

Overall system performance finally achieved, however, was excellent as 
validated by the flight test results. 


• COMPUTER REDUNDANCY MANAGEMENT 
EFFORT UNDERESTIMATED 

• GROUND TEST TOOLS FOUND TO BE LACKING 
(MULTI COMPUTER OPERATION) 

• GENERIC COMPUTER HARDWARE PROBLEMS 

• FAIL OP-FAIL SAFE OPERATION VERIFIED 

• CONTROL LAW VERIFICATION ROUTINE ONCE BASIC 
OPERATIONAL ASPECTS OF SYSTEM MATURED 

• NO EMI PROBLEMS 

• NO STRUCTURAL MODE INTERACTIONS 

• EXCELLENT SYSTEM PERFORMANCE ACHIEVED 
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